Ingress未使用Let's Encrypt证书问题排查求助

问题根源分析 #

1. 证书Secret未生成：你注释了cert_manager模块中的certificates配置块，cert-manager没有为域名api.project.io生成对应的Let's Encrypt证书Secret。
2. ClusterIssuer注解错误：Ingress的cert-manager.io/cluster-issuer注解误用了ClusterIssuer的私钥Secret名称，而非ClusterIssuer本身的名称。
3. 重复部署Ingress控制器：同时通过官方Helm Chart和自定义模块部署了两个Nginx Ingress控制器，导致资源争抢配置冲突。
4. Ingress Class不匹配：Ingress的ingress_class_name设为nginx2，但控制器使用的是默认nginx类，无法关联。

修复步骤 #

1. 启用cert-manager证书生成配置 #

取消cert_manager模块中certificates块的注释，明确指定域名和证书Secret名称（注意：ClusterIssuer的私钥Secret是自身使用的，不要和业务证书Secret混淆）：

module "cert_manager" {
  source = "terraform-iaac/cert-manager/kubernetes"

  cluster_issuer_email                   = "dan.habot@gmail.com"
  cluster_issuer_name                    = "cert-manager-global"
  cluster_issuer_private_key_secret_name = "cert-manager-private-key"
  cluster_issuer_create = true

  # 启用业务证书生成
  certificates = {
    main = {
      dns_names = ["api.project.io"]
      secret_name = "api-project-tls" # 用清晰的名称区分ClusterIssuer私钥和业务证书
    }
  }

  create_namespace = false
  namespace_name   = kubernetes_namespace.project.metadata[0].name
}

2. 修正Ingress配置 #

• 修正cert-manager.io/cluster-issuer注解，指向ClusterIssuer的名称
• 更新TLS配置中的secret_name为cert-manager将生成的业务证书Secret
• 对齐Ingress Class与控制器配置：

resource "kubernetes_ingress_v1" "nginx" {
  metadata {
    name      = "nginx"
    namespace = kubernetes_namespace.project.metadata[0].name
    labels = {
      "ingress" = "entrypoint"
      "app.kubernetes.io/name" = "ingress-nginx"
      "app.kubernetes.io/part-of" = "project"
    }
    annotations = {
      "kubernetes.io/ingress.class" = "nginx"
      # 正确指向ClusterIssuer的名称
      "cert-manager.io/cluster-issuer" = module.cert_manager.cluster_issuer_name
    }
  }

  spec {
    tls {
      hosts       = ["api.project.io"]
      # 对应cert-manager生成的业务证书Secret
      secret_name = "api-project-tls"
    }

    # 修正为控制器使用的ingress class
    ingress_class_name = "nginx"

    rule {
      host = "api.project.io"
      http {
        path {
          path = "/alerts"
          backend {
            service {
              name = kubernetes_service.alerts_service.metadata[0].name
              port {
                name = kubernetes_service.alerts_service.spec[0].port[0].name
              }
            }
          }
        }
        path {
          path = "/loader"
          backend {
            service {
              name = kubernetes_service.httploader_service.metadata[0].name
              port {
                name = kubernetes_service.httploader_service.spec[0].port[0].name
              }
            }
          }
        }
      }
    }
  }
}

3. 删除重复的Ingress控制器 #

移除自定义的nginx-ingress-controller模块，保留官方Helm Chart部署的控制器。如果需要TCP服务转发，直接在官方Helm配置中添加：

resource "helm_release" "ingress-nginx" {
  repository = "https://kubernetes.github.io/ingress-nginx"
  chart      = "ingress-nginx"
  name       = "ingress-nginx"
  set {
    name  = "controller.publishService.enabled"
    value = true
  }
  set {
    name = "controller.admissionWebhooks.certManager.enabled"
    value = true
  }
  set {
    name = "controller.scope.namespace"
    value = kubernetes_namespace.project.metadata[0].name
  }
  set {
    name = "controller.tcp.configMapNamespace"
    value = kubernetes_namespace.project.metadata[0].name
  }
  # 添加TCP服务转发配置
  set {
    name = "controller.tcp.${kubernetes_service.httploader_service.spec[0].port[0].port}"
    value = "${kubernetes_namespace.project.metadata[0].name}/${kubernetes_service.httploader_service.metadata[0].name}:${local.alerts_port}"
  }
  set {
    name = "controller.tcp.${kubernetes_service.alerts_service.spec[0].port[0].port}"
    value = "${kubernetes_namespace.project.metadata[0].name}/${kubernetes_service.alerts_service.metadata[0].name}:${local.httploader_port}"
  }
  set {
    name = "webhook.enabled"
    value = "true"
  }
  set {
    name = "rbac.create"
    value = "true"
  }
  set {
    name = "ingressShim.defaultIssuerKind"
    value = "ClusterIssuer"
  }
  set {
    name = "ingressShim.defaultIssuerName"
    value = module.cert_manager.cluster_issuer_name
  }
}

4. 验证部署结果 #

应用配置后，执行以下命令确认状态：

• 检查证书状态：kubectl get certificates -n project，状态应为Ready
• 确认证书Secret存在：kubectl get secrets api-project-tls -n project
• 查看Ingress关联状态：kubectl get ingress nginx -n project
• 检查控制器日志：kubectl logs -n project deployment/ingress-nginx-controller，确认无证书加载错误

内容的提问来源于stack exchange，提问作者Dan